Slashdot videos: Now with more Slashdot!

View

Discuss

Share

We've improved Slashdot's video section; now you can view our video interviews, product close-ups and site visits with all the usual Slashdot options to comment, share, etc. No more walled garden! It's a work in progress -- we hope you'll check it out (Learn more about the recent updates).

sfcrazy writes "The Free Software Foundation (FSF) has published a whitepaper suggesting how free operating systems can deal with UEFI secure boot. In the whitepaper, the foundation has criticized the approach Canonical/Ubuntu has taken to deal with the problem. The paper reads: 'It is not too late to change. We urge Ubuntu and Canonical to reverse this decision, and we offer our help in working through any licensing concerns. We also hope that Ubuntu, like Fedora, will actively support users generating and using their own signing keys to run and share any versions of the software, and not require users to install a key from Canonical to get the full benefit of their operating system.'"

... for someone to hack the secure boot BIOS and provide an easy way for users to reflash theirs from Windows or whatever OS is preinstalled on the machine when bought new. No doubt this will prevent windows being reinstalled but unless you want a dual boot machine I doubt this matters much.

On a related note, how will this affect linux being booted from within windows (if anyone still uses that approach)?

Sadly I think this may well be true in the future if hacking your own PC is treated by Microsoft the same way that modchipping your PS is treated by Sony

I haven't really been paying attention to what Sony has been doing (don't own a PS3), but I wonder if Sony really cares about modchipping itself, or if they just want to keep modded consoles off of PSN?

The latter seems reasonable to me... If you want to mod the console, fine. Just don't expect to be allowed to play in the sandbox with all of the unmodded consoles. You know if they let modded consoles on that games would be flooded by griefers and other annoying breeds of adolescent (chronological or mental).

They always tried to shut down vendors of modchips during the PS2 era. They often succeeded too. Many of the retailers from back then were stomped under the Sony jackboot. There wasn't any online to speak of back then, and they still maintained that modchipping was a criminal act.

Dan would eventually find out about the free kernels, even entire free operating systems, that had existed around the turn of the century. But not only were they illegal, like debuggers—you could not install one if you had one, without knowing your computer's root password. And neither the FBI nor Microsoft Support would tell you that.

Is there actually any evidence to back up this assertion? The stated reason is to prevent malware replacing the bootloader or low level drivers, and to prevent bootloaders used for piracy. Both are pretty common these days.

What benefit would MS gain from locking out other operating systems? Linux is still no where near making an substantial inroads on the desktop or on tablets. Okay, there is Android, but do they really think many consumers will want to replace their tablet's OS with a different one?

I'd say the ultimate solution is for every linux fan to stop recommending computers with locked BIOSs, push hardware with coreboot, and to ignore distros which aren't playing ball. Cracking it is the pragmatic solution.

I'd say the ultimate solution is for every linux fan to stop recommending computers with locked BIOSs, push hardware with coreboot, and to ignore distros which aren't playing ball. Cracking it is the pragmatic solution.

I've been using Linux for ten years, since August of 2002, and I don't know what the FUCK any of this means.

So far there's no indication that you need to hack anything. Microsoft requires that PC's sold as certified for for Windows 8 allow you to enter custom mode and load your own certs. The reason Linux Distros are going the routes they are, using a Microsoft Signed boot loader, is that they want something that will be bootable on any machine out there with out having to enter the bios. While your typical users here on slashdot probably doesn't have any problems entering their bios and adjusting Bios settings for many other users is something they've never done and it's going to be extremely specific to that mfgs implementation on that particular hardware so no general set of instructions is possible.

Isn't entering the BIOS pretty much the only way to install Linux on many PCs now? By default most seem to be configured not to boot from CD or USB drive and the boot menu key is disabled. Manufacturers don't want the hassle of dealing with people who left a bootable CD in the drive.

Doable, I am sure. But it'd have to be done for every motherboard and every revision, and meddling in the EFI at that level is how you brick things. It's not the type of dangerous, difficult operator you want to require linux newbies do before they can even install it.

So it's come to the point of having to attack our own computers just to run the software we want? The fact that we have to resort to these measure is a sign of just how bad things have gotten.

provide an easy way for users to reflash theirs from Windows or whatever OS is preinstalled

So to run free software, I have to first agree to yet another license for proprietary software? That is a step backwards if I have ever seen one.

No doubt this will prevent windows being reinstalled but unless you want a dual boot machine I doubt this matters much

There are lots of people who want or need dual boot. I would guess that a substantial fraction, maybe even a majority, of GNU/Linux users have dual boot. People should be free to use their computers the way they want, which includes the freedom to dual boot.

We've been at that point for quite a while now. Have a look at any of the iDevices. Even some of the Android phones have locked bootloaders (which don't restrict which apps you can install, but they limit your OS options). We're just seeing it spread, much like the locked Apple market is spreading to Windows metro.

Indeed, although we can at least find computers from major manufacturers that will run GNU/Linux -- and we can tell people what to avoid. With Microsoft going full-steam on restricted boot environments, it will only be a few years before we cannot buy a laptop from Dell that will run GNU/Linux (except for those distros that have made a deal with Microsoft -- so much for choice).

Well if you are worried then the answer is simple, support AMD who has switched to Coreboot [softpedia.com] instead of UEFI as the replacement for BIOS. Since I doubt VERY seriously MSFT would have the brass balls to try to ban AMD systems from running Win 8 (and most likely risking another antitrust investigation) they will have to allow AMD systems to use Coreboot which means if you don't like it? The source is right there, help yourself and flash away.

But whether FSF likes it or not MSFT seems bound and determined to get rid of Windows piracy not with the carrot but with the stick, since its common knowledge that Win 7 is completely cracked wide open thanks to bootloaders that even allow the machines to get all updates without so much as a WGA warning so like it or not MSFT is gonna push this. At least AMD is supporting an open tech that you can flash yourself, although you always have the option of just turning the damned thing off and not using Secureboot.

Personally while i think offering Win HP for $50 and the Family Pack for $100 (which there is one of the family packs being offered right now on deals.woot for $95 and free shipping, its on page 4 i believe) to end piracy ultimately its their OS and they can be as tarded as they want with it. I think everyone is getting their panties in a wad over nothing myself, the amount of backlash I've seen at the shop over Win 8 is 10 times worse than Vista so I have a feeling its gonna be the new MS Bob and the OEMs are gonna be killing secureboot and shipping Win 7 as fast as they can get them out the door. Don't forget Vista had crazy anti-piracy shit in it too and it BOMBED like Michael Richards at an NAACP fundraiser so I really think we don't have anything to worry about here.

You can now, yes. But remember the big push for Secure Boot is from Microsoft. A company with a long history of using every dirty and underhanded trick in the book, including a few of their own invention. I do not trust them: Today they only make it enabled by default, but in a few more years they may take away the capability to disable it entirely.

They already are taking it away on ARM based systems. "On an ARM system, it is forbidden to enable Custom Mode.... Disabling Secure MUST NOT be possible on ARM systems" (page 122 of Windows Hardware Certification Requirements [microsoft.com])

Given the very high proportion of servers that run (a) the world's major businesses, and (b) Linux, I think we're fairly safe on that one. These servers are often administered by people who know what they're doing and who chose Linux over a Microsoft stack for a reason.

Not even Microsoft are powerful enough to change that, or they would have done so a long time ago. I think any serious attempt to take control of the hardware platform would result an expensive backlash and PR headache at best.

Servers, obviously. But OEM desktops, which make up the vast majority of computers and all the ones affordable? If Microsoft can get things to the point where the only (legal) way to run linux is to buy a server-class computer that costs three times as much as a PC of equivilent specification, that's a major victory for them and a major defeat for linux. You can't attract new users to try something if there is a $2000 up-front cost for the hardware.

For desktop Linux, why couldn't you put together a machine from your own hardware instead of relying on an OEM? Plenty of people already do that, not least so they can be confident they've chosen components that won't have any compatibility problems with Linux, and as long as individuals can do it, there will always be the potential for businesses to spring up as well if the demand is there.

Novell made a killing and and was an industry powerhouse for decades. Much of their wealth came from making the Microsoft environment easier to use.

Also many of Microsoft's biggest competitors started of by being compatible with Microsoft. Google providing Exchange protocol services, Office file format compatibility, same with Apple, OpenOffice, etc. And that hasn't worked out too bad for them.

And it's always been on the thin edge of the razor. Microsoft has readily yanked their chains by changing the file formats and protocols, keeping them perpetually behind in terms of compatibility.

As for Novell, compatibility providing a few years of bounty is meaningless when the source of that bounty turns around and uses their monopoly to effectively drive you from the market. All you've done is made them more powerful.

not as much, but still (for planning to use the MS key). It's a very bad position we (Free Software) are in with Restricted/Secure boot. I think it's time the Linux friendly vendors really get behind CoreBoot [http://www.coreboot.org/Welcome_to_coreboot] and let us be truly independent.

As it is setup right now:Binaries can only be signed with one key. If you use Microsoft's key, you can't use your own.Not all vendors may support letting users add their own keys. (and even if they do it certainly complicates a fresh install).ARM will be completely locked down if vendors want MS to run on it.If you use the Microsoft key, they can revoke your access (they likely need cause, but still)

Microsoft's key is the only one that you can be sure all computers will have, and so the one all vendors will have to sign with. Making it pointless for them to even have their own keys. By design, I am quite sure: The limit is one-key-only because it was always intended that only one vendor would survive. Microsoft.

If memory serves the Microsoft key is pretty much going to be required no matter what Fedora or Ubuntu does because PCI-E cards will have their bios signed with a MS key and you have to trust them in order to do secure boot.

Why CoreBoot? What's wrong with stuff like OpenFirmware, or even just finishing projects to boot properly from EFI machines [sourceforge.net] (which are not "secure"). There's no reason to ask HW manufacturers to adopt some completely new firmware stack when there are already-working ones which are more than "open" enough. The only real problem here is with this new Secure Boot add-on, but there is no reason to throw the baby out with the bathwater. OpenFirmware / EFI can replace BIOS just fine and not have any restrictions. They already exist and manufacturers already know how to use them.

Ubuntu/Canonical has been the worst type of Karma whores since the beginning.
They built a following by pimping the philosophy of freedom, only to abandon these ideals once the foundation was set.
They have enouraged people to accept non-free video and wireless drivers, while companies like RedHat have tried to work with Vendors and educate folks about why this is a bad thing.
Now with their app store with non-free projects; they've even undone this feat with kneeling towards Redmond (secureboot).
I kno

hey built a following by pimping the philosophy of freedom, only to abandon these ideals once the foundation was set. They have enouraged people to accept non-free video and wireless drivers

Really now? So it wasn't defaulting to the piece of shit Nouveau driver instead of the Nvidia blobs for the past few releases, making me have to jump through hoops before I decided to just use Xubuntu in Virtualbox on Windows instead of fucking with it anymore.

There's a lot of legitimate shit you can call Canonical on. Let's focus on the real ones instead of on the "free as in what we say it is" frothing.

No, a few purists decry the implicit endorsement of closed binary by Ubuntu working to automatically lead a user to use the nVidia binary instead of the less featureful Nouveau drivers. They appreciate Fedora's stance, hoping that one day it will topple nVidia's thinking and result in a quality open source driver, but see players like Canonical ruining that opportunity to change reality for the better.

More pragmatic Linux users express a sentiment that they appreciate Ubuntu's efforts to more carefully con

RedHat have tried to work with Vendors and educate folks about why this is a bad thing

The key word here being 'tried'. It really hasn't done anything to change the ubiquity of MP3 and h264. In that case, the momentum (mp3 is as good as the alternatives technically and has been around longer) or technical merit (h264 hs *no* unencumebered competition to acheive the same results) far offsets the ideology of 'free' for most of the world that we must live in. We aren't sufficiently better off in drivers due to RH's stance (fglrx and nvidia drivers are still pretty much required to extract val

This is the start of a sea change in who controls our computers. Yes, for now you can turn it off (oh, sorry, unless you're using an ARM system), but this is just the first step. They can't go the entire way all at once. They've tried before, and learned they have to go one step at a time. Each step doesn't seem so bad, until finally, all the cards fall into place.

Already most of our mobile devices no longer belong to us, unless you manage to defeat the device's security that is meant as security against YOU, the owner of the device. Bought anything with iOS, or about 95% of the Android devices? Or WP7? Sorry, someone else owns it even after you purchased it. That's the world that many powers like Microsoft and many governments desire for the whitebox PC. A locked down device that obeys other masters, only booting "trusted" OSs that let those masters have the final say over what your computer does. Because a world where a billion individuals had control over their own computers could not be allowed to persist. It threatens too many corporations and governments.

Of course, people will buy these increasingly locked down PCs just like they are falling all over themselves to buy tablets, so this world WILL come to pass. All we can do is figure out how to deal with it.

Intel knows where they can make money from GNU/Linux: servers. That is not the target of this restricted boot system, and even if these restrictions come to servers, nobody will complain -- professional IT workers can put a $99 signing key purchase on their budget and continue to deploy whatever they want. Desktop GNU/Linux is not going to make Intel all that much money, and they know it -- Windows and Mac OS X are where all the desktop money is.

Intel and everyone else knows that restricted boot environments for personal computers (desktops and laptops) will be hugely profitable. Entertainment companies love it -- they can deploy a new kind of DRM that won't be defeated for years (see: PS3). Software companies love it, because they can stop people from applying cracks to evade DRM. ISPs love it because they can better lock-down their networks if they can control the computers that can be connected to those networks. The potential for money-making deals is HUGE, and Intel knows that when their chips are the center of these profitable systems, they make lots of money.

At the end of the day, Intel could not care less about hackers or computing freedom; they exist to make money, and there is no money to be made in allowing desktop and laptop users to have freedom.

For now indeed -- it is blindingly obvious that this is a temporary situation.

If SecureBoot is on, the requirement is that the code executed before ExitBootServices() has to be signed

Thus closing the one remaining loophole in PC DRM, the loophole that has been the bane of entertainment and software companies (and especially the combination of those, video game companies) for decades. If the bootloader must be signed, then the bootloader can be designed to only load a signed kernel, which will only run signed applications, which will not receive signatures if they can possibly circumvent a DRM system. That is the point here -- you will not be able to just patch software to remove license checks, you will not be able to cheat in video games by executing code in kernel mode (yes, really, people do this -- in MMORPGs, where cheating successfully can yield real world profits), you will not be able to examine memory from processes that forbid it (so no more grabbing secret keys out of RAM), etc. The only reason that has not happened yet is that the PC software ecosystem is so massively complex and there is so much legacy code that no longer has anyone maintaining it, all of which has to be run somehow. I suspect that Microsoft's solution to that will be to create a secure sandbox where unsigned code can be run, but where it is unable to interact with any other software (so e.g. unsigned code could open some process' memory and examine it, but only if that process is running in the sandbox -- and of course, a signed application could forbid being run in a sandbox). They cannot do everyone at once -- gradually moving in for the kill is a better tactic for them.

So for example one can create a Boot Loader like EFILinux that will be signed and conform to the specification, and that can load unsigned kernels, and those unsigned kernels can contain any code

Sure, but look at the Fedora rationale; they noted that if they sign code that can be used to launch "malware" that attacks Windows, they will get in trouble. That's the difficulty here -- for a system to be secure in the restricted boot / DRM sense, in must never allow unsigned code to run, except in a strictly confined environment (so certainly not in kernel mode). For now, you can load an unsigned kernel, but the noose is already around your neck -- if you get caught doing something Microsoft (or whoever else) doesn't like, you are in trouble.

My big concern is corporate computers. If your company is issuing you a computer, and they don't realize that some engineers want to run Linux, they may not let you install new keys or disable the secure boot. This is where it's a good idea to have one vendor using the Microsoft key, and other vendors using their own keys (and hopefully getting major PC sellers to include those keys). That way we at least have one solution that will work even on a locked-down system.

If your company is issuing you a computer, and they don't realize that some engineers want to run Linux, they may not let you install new keys or disable the secure boot

Sounds like a big selling point: "Make sure your employees only run approved software!" Corporate bosses are not going to complain about losing control, and if the engineers are unable to make a business case for approving another OS (see how things switch up there), they had better just deal with what was approved.

I think Red Hat's strategy is to be the Linux distribution that will work without having to mess with any secure boot issues,

Which is a fine strategy for making money on a GNU/Linux distro, but some of us would prefer not to have to get Microsoft's permission to run the software we want to run. If you look at wh

Although it was obvious the FSF would take this position, as it should, isn't it strategically wise to have multiple solutions for users to load a (mostly) free software OS on hardware with UEFI? For similar reasons, I think it's good to have Android devices running ClockworkMod so that they may boot CyanogenMod/Replicant. I understand that we (free software advocates) should always be encouraging consumers to make smart choices and purchase devices that will run free software (and a complete free software stack, when that's possible).

However, free software would become an "oasis in a desert", rather than a large and thriving ecosystem, if binary blobs, non-free drivers, non-free BIOS's, firmware hacks, etc. weren't around. It would become increasingly difficult to bring in more users. Those who have developed free software implementations to replace proprietary ones originate from all over the free software spectrum, so the pool of developers would also shrink.

I think you always want both: the hardcores who will run free software and free software only, and those who will make compromises on devices until (if/when) stable free software is developed for those devices. The FSFE's advice on installing CyanogenMod [fsfe.org] seems like a sensible approach that takes this into consideration. Likewise, why not help someone install as much free software as possible on a device with a non-free BIOS/bootloader?

It seems to me that UEFI will die a quick death if we A) fight very vocally against it, B) convince powerful corporations and governments that it's bad for them, C) ignore it where/when we can, and D) help others to circumvent it when necessary. It doesn't seem much different than the DRM problem in that way.

I would be very happy with Canonical's UEFI strategy if the following from this past/. comment [slashdot.org] can be done:

- Canonical will get efilinux signed with microsoft keys. So GRUB2 has to be made bootable from efillinux (efilinux is rather primitive, it just loads a kernel from a set collection of blocks from the device and run it. It shouldn't be too much difficult to have efilinux load and execute a GRUB2's "stage 1.5" or "stage 2").
Thus efilinux is the part that needs to be signed with microsoft's key (and efilinux's license makes it possible. Although that also means that you won't be able to hack it).

...

- GRUB2 can load coreboot (an opensource firmware) payloads, so it could also load SeaBIOS (a legacy BIOS implementation as a coreboot payload).
- GRUB2 can also load windows XP's boot loader.
So if any of the above is possible (either chainloading efilinux to grub2, or signing grub2 in a gplv3 compatible way). That means that grub2 could be used to boot windows XP on secure-boot hardware. (with seabios providing the legacy bios compatibility, and windows XP's ntldfr being loaded from grub2).

That unfortunately-complex method of chaining together multiple bootloaders seems to allow for any OS, even legacy ones, to boot (or at least attempt to boot) on UEFI hardware. Such a door might be closed if Canonical decides it won't play ball with Microsoft, and that seems like a door worth having open. However, I welcome any rebuttals...I don't know nearly enough about the issue.

The problem, again, is not UEFI but secure boot. The two are not inextricably linked.

It doesn't seem much different than the DRM problem in that way.

You'll have an uphill battle. Apple is transparently convincing people that DRM is good.

chaining

Can't happen. If any point has a flaw then the key gets revoked. From the UEFI platform down to the kernel needs to be "trusted" to betray the user, and the kernel must be secured against local exploits that allow bypass

While they have some similar goals, TPM and UEFI are different things. Almost all PC hardware in existance now is already capable of remote attestation since TPM modules have been around for years now. You can even set up a linux OS so that it can only mount an encrypted volume if it was booted via the trusted path - if you boot from a CD and chroot to the root volume it won't be able to mount the encrypted volume. Ditto if you change the bootloader or kernel. Google for trusted grub sometime.

Half-joking, but I wonder if contracting out a community-speced and community-funded motherboard would be possible. It might be worthwhile if for no other reason than to possibly catch MS leaning on contract manufacturers from even considering fabbing a motherboard outside of their control.

Linux has gone mainstream... Just not on the desktop. Where is remains a distant 3rd behind Windows and OS/X.With Android, Linux is quite popular with mobile. Linux is also strong on the server side too.Linux never made it to the desktop, because there were too many drivers to support. When you luck out and get a System that is well supported by Linux... Linux rocked on that system. However if you try to put Linux on a poorly supported system, it usually sucked, and felt like a cheap OS.

If Microsoft make "Windows 9" a Linux Distribution with a Windows themed UI. It would probably be just like Vista, many people complaining about hardware compatibility, systems crashing all the time (due to improper drivers)

Drivers are only a part of the problem. The biggest is the fragmentation, of well, everything. The UI is different for every distro, every version, and every update. The configuration files are different for every distro, version and update. Besides a few very well known apps, compatibility of binaries and apps are a real crap-shoot.

Linux will become mainstream the second that the number of CSE graduates outnumbers any other major in society.

Platform fragmentation that keeps developers and publishers away, tons of UI/UX rough edges, very powerful customization that is never backed by some serious graphical utility just configuration files so that newcomers can get scarred of screwing up (or screwing up again and again), cool technologies and flashy features that changes the environment every Thursday or so, being pushed before stabilizing core software, plethora the apps each written in a dozen programming languages, widget set, frameworks, dozens of libraries to parse command-line parameters or whatnot, lack of proper contingencies when screwing up (especially when dealing with xorg)

I still love the platform even if it's all over the place. Linux isn't popular because one of it's strengths, diversity, is being prioritized more than anything. Many people can't see that scratching an itch in three different places has no chance of 100% effectiveness.

The biggest is the fragmentation, of well, everything. The UI is different for every distro, every version, and every update

Only someone who hasn't done years of work on Microsoft systems could seriously claim this as a drawback for Linux. How many different GUI toolkits in its various OS versions is Microsoft up to now? 4? 5? It probably depends on how you count...

The linux kernel is the choice of most of the embedded community (which Google Android is part of) and has garnered its mainstream acceptance in this market since the kernel was first introduced. Google picked the Linux kernel to host the Android OS not only because it was free, but because the Linux kernel was already prevalent in the embedded market and was compatible with the ARM processor. Android OS may have increased the number of units sold with the Linux kernel installed, but it DID NOT make Linux mainstream in the embedded market.

Android didn't even make Linux mainstream to the general public. The consumer has no direct contact with the kernel, nor is Linux mentioned in any marketing done by Google to the general public. In this case, the linux kernel is just a part of a much bigger OS being installed on a mobile phone. I think when most people think of Linux they think of the Linux kernel with the Posix compliant runtime environment. Android does not fit this definition.

Nitpicks aside... Linux only has mainstream acceptance in the embedded and server market. People purposely choose a Linux OS to run on a server. People do NOT choose a Linux OS to run their phone (well not a lot of them), they instead choose Android OS which Google spent large amounts of money to market it. My point being that in order to be considered "mainstream" the community at large would consider picking your product directly versus as an internal part of a much more popular product.

I realise it must have been a great trauma to you to have RMS jump through your window wielding a katana and forcing you to install gNewsense GNU/Linux, but seeking counselling is a better solution than going on about it on Slashdot.

Wait, that did not happen? Oh, you were confusing 'criticizing' with something else; and implying that the FSF have no right to express their criticisms. Hmmm. Seems like a prime example of the pot calling the kettle black, don't you think so yourself?

it appears that the FSF is feeling hurt because Ubuntu is switching to another open source bootloader that doesn't use the GPL.

No, they're concerned that Ubuntu is giving up a GPL bootloader because they're choosing to adopt Microsoft's secure-boot solution, which effectively puts all such systems under Microsoft's control and makes it infinitely harder for "unapproved" software to run on the systems (which, if Microsoft's attitude is any indication, would include virtually all Free Software.)

companies have the right to secure their computers.

So my computer belongs to Microsoft? Dell? Asus?

Perhaps you missed the bit where ALL systems with the Windows 8 logo were going to be forced into this locked state by default. It's not just a corporate security feature, it's being rammed down ALL of our throats.

Except it isn' 'Microsoft's secure-boot solution', it is the Trusted Computing Groups secure-boot solution. Microsoft is a 'promote'r of TCG, but so is AMD, Intel, Cisco, IBM, HP, Fujitsu, Juniper, Infineon, Wave, and Lenovo. Move down into the 'Contributor' category and you add dozens more companies, including Red Hat, Accenture, AMI, Dell, Freescale, Toyota, Hitachi, General Dynamics, Sony, Seagate, Western Digital, etc.

Surely you don't think that all those companies are interested in Trusted Computi

Except it isn' 'Microsoft's secure-boot solution', it is the Trusted Computing Groups secure-boot solution. Microsoft is a 'promote'r of TCG, but so is AMD, Intel, Cisco, IBM, HP, Fujitsu, Juniper, Infineon, Wave, and Lenovo.

Microsoft has been a hard-driver behind ALL of this.

Move down into the 'Contributor' category and you add dozens more companies, including Red Hat, Accenture, AMI, Dell, Freescale, Toyota, Hitachi, General Dynamics, Sony, Seagate, Western Digital, etc.

And you'll find that promoters have way, way more say than most Contributors, once you get inside these groups.

Surely you don't think that all those companies are interested in Trusted Computing just because Microsoft is insisting on it, do you?

Generally they're all assholes when it comes to restricting users. Microsoft just happens to be an 800lb gorilla.

Secure boot is just one little link in the chain of Trusted Computing.

Indeed, a chain secured by a lock you won't have the key to.

It is the first test that FOSS is facing with regard to the upcoming changes in computing. There will be many more to follow. If FOSS wants to remain relevant in the coming age where owners demand tighter control over their data they are going to have to figure out how to adapt.

FOSS is explicitly being excluded in these situations. All of these "solutions" require some 3rd party to be trusted and for the entire platform to be geared to work AGAINST the user, who is treated like the enemy rather than the party to be protected.

Now, there is nothing that is incompatible with the ideas of 'open source' and the ideas of 'trusted computing'.

Of course not, but that would imply that 'trusted computing' put the user in a 'trusted position.' The vast majority of current applications do not. The user is completely untrusted and given a little sandbox to piddle around in.

There is absolutely no technical reason that Red Hat, or SuSe, or Ubuntu, can't provide a 100% FOSS solution that is trusted. The only thing that could hold them back is putting ideology first.

Or the fact that a FOSS solution that is trusted is pretty much 100% antithetical to the concept behind FOSS, especially when you've effectively TiVOized everything by locking it up and not giving the user the key.

Whoa easy killer, I didnt know they personally came in and saved you and your family from terrorist mere moments before being shot in the head. I just think its funny that a group that advocates software freedom always gets their panties in a big ole wad when someone does something they didnt like. Fuck them its none of their concern what Ubunutu uses as a bootloader, thats (gasp) freedom.

Freedom for whom?

That's really the question you have to ask, because anytime that you work to guarantee freedom for one group, you are restricting the freedom of another. For example, guaranteeing freedom of speech in the first amendment restricts the legislative freedom of the US government and prevents them from passing certain hate speech laws.

The FSF doesn't hide the fact they are for freedom for the users. In order to guarantee this freedom, they aim to restrict the freedom of developers, distributor

Agreed. While I think this issue certainly warrants discussion, the whole article comes off as childish with quips like this:
"we view Windows itself as malware and want to keep it away from our machines."
They seem like they are making a big deal out of this thing just to sound holier than thou. Their ideal situation, where users can install their own certificates or choose to disable secure boot, is exactly what is mandated by Microsoft (for x86 at least). They even mention this in the article. The

You don't have to rely on Canonical unless you want to use their product, which is essentially what choosing software is, you use someone's software (maybe your own) over someone else's because of the choices they made.

Sure, that's the way things work right now. When UEFI restrictions come into play, things start to work differently. I can choose not to use Ubuntu and Fedora, and then what? I get stuck jumping through hoops just to install anything else -- and while I have the technical expertise and patience needed to do so, it is still annoying, and for some people it is either too annoying or too difficult to do.

That is the choice this situation forces you into: either you accept the code written by Fedora or Ubuntu, or you have to work hard to get something else up and running / pay for the right to do so. You are not able to simply reject those distros whose choices you disagree with; you must decide if those accepting those choices would be as bad as trying to get something else to work. A few months ago, I stopped using Fedora because of a disagreement I had with their choices (completely unrelated to the boot process); now I have to reevaluate that, because getting the distros I like to run on the next laptop I buy might require more of a time commitment than I can make.

I honestly don't understand how you have a problem with the concept of distros deciding to do certain things certain ways? Did you write your own package manager and kernel? In which case why are you using Ubuntu anyway? Why are you even using Linux, they've made all sorts of choices for you.

I am free to accept or reject the choices that other people made. I can always fork a project if I do not like the direction it is taking. Except, of course, if I need a digital signature from the project in order to run my fork on my own computer / if I have to get some company's permission (i.e. by paying a fee).

It is not about other people making decisions; it is about my freedom to accept those decisions. Maybe I like everything in Ubuntu, except for the bootloader -- maybe I really want to run grub2. Now I am stuck jumping through all sorts of hoops to get that to work -- either buying a key and agreeing to contracts, or putting the system in custom mode and instructing anyone who wants to use my code to do the same. Forking a distro in this model sounds like a giant pain, with extra hurdles and hoops that just push people to use the handful of distros that can pay to play.

Hell, even this is an oversized bloated bootloader if all you need to do is always boot ONE system and leave it running until the cleaning crew takes your power outlet. GRUB1 was horrible thought at least it was reasonably well documented, eventually. GRUB2 was worse, and depricated GRUB1 even before they had the equivalent docs out. And LILO is not even in the running. There are a couple micro boot loaders around that work on PCs, and those would be good.

You don't have to have all of GRUB. And since GRUB is modular these days, the parts you're not using aren't even loaded. Disk space is cheap, but you can always delete the modules you don't have room for in space-limited environments.